North Korean fake job interview planted the malware behind Binance's $6.3B heist
North Korean fake job interview led to $6.3B Binance heist
Binance says the record-breaking $6.3 billion theft began with a fake job interview: a recruiter on a legitimate job platform built trust with personal photos, then sent a software engineer a coding assignment laced with malware. The compromised work laptop and an internal AI tool let attackers reach wallet infrastructure, where stolen deployment credentials triggered the October 29 attack. The FBI attributes it to North Korea's TraderTraitor. Binance has rebuilt the wallet system and replaced affected devices.
Our current investigation indicates that this was a sophisticated, multi-stage campaign. It was not a single isolated breach or a simple phishing incident.